升级AuthLogic后旧密码无法识别的适配方案咨询

Hey there, this is a super common gotcha when jumping major versions of AuthLogic—let’s break down the fixes step by step to get those old passwords working again:

1. Revert to Your Original Crypto Provider #

AuthLogic changed its default encryption algorithm between 3.x and 4.x. Your old Rails 3.2.2 + AuthLogic 3.0.0 setup almost certainly used Sha512 as the default hashing method, but 4.0.1 switches to BCrypt by default. To make old passwords recognizable again, explicitly set the original crypto provider in your user model:

class User < ApplicationRecord
  acts_as_authentic do |config|
    # Use the same hashing algorithm your old app relied on
    config.crypto_provider = AuthLogic::CryptoProviders::Sha512
    # Swap in Sha256 here if that's what your old setup used instead
  end
end

Test this right away: fire up your Rails console and run User.find(your_old_user_id).valid_password?("their_old_password")—it should return true now.

2. Gradually Migrate to New Encryption (Optional) #

If you want to eventually switch to the more secure BCrypt (highly recommended!), you can configure AuthLogic to check both old and new hashes, then auto-upgrade the hash when a user logs in:

class User < ApplicationRecord
  acts_as_authentic do |config|
    # Check BCrypt first (for new users), then fall back to Sha512 (old users)
    config.crypto_providers = [AuthLogic::CryptoProviders::BCrypt, AuthLogic::CryptoProviders::Sha512]
  end

  # Auto-update password hash to BCrypt when an old user successfully logs in
  def valid_password?(password)
    is_valid = super
    # If valid and current hash isn't BCrypt, re-save with the new algorithm
    if is_valid && !AuthLogic::CryptoProviders::BCrypt.matches?(password_hash, password)
      self.password = password
      self.password_confirmation = password
      save(validate: false) # Skip extra validations to streamline the update
    end
    is_valid
  end
end

This way, over time all your users will automatically switch to the newer encryption without ever having to reset their passwords manually.

3. Check for Custom Encryption Logic #

If your old Rails 3.2.2 app had any custom password code—like overriding encrypt_password or modifying salt generation—double-check that it’s compatible with AuthLogic 4.x. The API changed slightly, so any custom methods might need small tweaks to play nice with the newer version.

4. Verify Database Field Integrity #

Quickly confirm that your password_hash and password_salt fields in the database haven’t been corrupted during the upgrade. Old Sha512 hashes should be long hex strings (no $2a$ prefix), while BCrypt hashes start with that prefix. If your old hashes look intact, the crypto provider fix should resolve the issue immediately.

内容的提问来源于stack exchange，提问作者Zia Qamar